A profound change in the way the U.S. government treats cloud data became law Friday with little or no debate, after President Trump signed the $1.3 trillion federal spending bill needed to prevent the government from shutting down.
Congress tacked the CLOUD Act onto the massive spending bill Wednesday night ahead of voting on the bill Thursday, and it became official Friday morning. The CLOUD Act clarifies how the U.S. government can access data of U.S. citizens needed for law enforcement investigations that is stored on cloud servers outside the country, which was the issue in a Supreme Court case between the Department of Justice and Microsoft earlier this year.
It also changes the way foreign governments request information from U.S. tech companies for similar investigations on their own citizens. The law calls for the executive branch of government to strike mutual legal-assistance treaties with foreign governments, who would then contact tech companies directly with their requests instead of routing through the DOJ. Tech companies would be able to push back on those requests, but the CLOUD Act removes a layer of judicial review from the process, which critics feel gives too much power to the executive branch in terms of which countries get to be in our information-sharing club.
The bill enjoyed bipartisan support as well as widespread support from big tech companies, led by Microsoft, but privacy advocates are worried that some of the protections against signing treaties with countries with poor human-rights records are weak. Foreign governments will also be able to turn over data on U.S. citizens gathered in the course of investigating their own citizens to U.S. law enforcement without a warrant, according to the ACLU.